golem15/msd-core
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #3611 from gsd-build/fix/3587-bug-security-check-ship-ready-shell-inje

Browse Source 
fix(3587)(security): argv-based subprocess for check.ship-ready
This commit is contained in:
Tom Boucher
2026-05-15 23:04:42 -04:00
committed by GitHub
parent 38f5201935 ac34ab2cec
commit 2cf4c8e8ec
3 changed files with 245 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.changeset/proud-sloths-rally.md Normal file
View File

@@ -0,0 +1,5 @@
---
type: Security
pr: 3587
---
**Fixed shell-injection in `check.ship-ready`** — a maliciously-named git branch (e.g. `foo;touch${IFS}INJ;bar`) could execute arbitrary shell commands when `gsd-sdk query check.ship-ready <phase>` ran from the repository. `sdk/src/query/check-ship-ready.ts` interpolated the current branch name into a shell-string `git config --get branch.${current_branch}.merge` and ran it via `execSync`. Every subprocess call in the module now uses argv-based `execFileSync` — the shell is never invoked, branch names are passed as opaque data, and no interpolation site exists.